Skip to content
New Pro plans with Agentic Verification.
SolutionsAll solutionsDORAPRA SS2/21NIS2CRAISO 27001SOC 2ISO 22301FFIECCPS 230ESMAEU AI ActCbwOpEx
By role · Compliance teams

What your framework asks for. What goes in your file.

For compliance officers and internal audit. DORA, PRA SS2/21, NIS2, CPS 230, ISO 27001, and SOC 2 each ask whether the software you rely on could be brought back without its supplier, and whether the exit has been tested. Codekeeper produces dated evidence for each application, and gives you the documents to review Codekeeper itself.

Book a demo
  • Trusted by 3 500+ teams
  • ISO/IEC 27001:2022 certified, audited by BSI
  • Evidence for DORA, PRA SS2/21, NIS2, CPS 230, ISO 27001, and SOC 2 files
A compliance officer walks an auditor through the supplier controls on file

Trusted by 3 500+ teams, from regulated enterprises to fast-growing software vendors

Airbus Bayer European Parliament General Motors Intuit Nestlé PepsiCo Pfizer

What your frameworks ask

Different rules. The same questions underneath.

Whether you answer to DORA, PRA SS2/21, NIS2, CPS 230, ISO 27001, or SOC 2, the auditor's question is close to the same: if a supplier failed, could you bring the software back and keep working, and how do you know? The question has moved from "do you have a contract?" to "could you leave, and keep running?" Each page below lines the evidence up with the wording of one framework.

EU

DORA

Regulation (EU) 2022/2554 · financial entities

Exit plans for ICT services that support critical or important functions: comprehensive, documented, sufficiently tested, and reviewed periodically (Article 28(8)).

DORA evidence UK

PRA SS2/21

PRA supervisory statement · outsourcing and third parties

Exit plans for material outsourcing that cover stressed exits, appropriately documented and tested as far as possible (paragraphs 10.10 and 10.24).

PRA SS2/21 evidence EU

NIS2

Directive (EU) 2022/2555 · essential and important entities

Business continuity, such as backup management and disaster recovery, and supply chain security, taking each direct supplier into account (Article 21(2)(c) and (d)).

NIS2 evidence AU

CPS 230

Australia · APRA operational risk management

For each material arrangement, being able to execute the BCP and to conduct an orderly exit if needed (paragraph 55). Core technology services are material by default (paragraph 49).

CPS 230 evidence ISO

ISO 27001

ISO/IEC 27001:2022 · information security management

Annex A controls for supplier relationships (5.19 to 5.22), information security during disruption and ICT readiness for business continuity (5.29 and 5.30), and information backup (8.13).

ISO 27001 evidence US

SOC 2

United States · service organization audits

Vendor and business partner risk (CC9.2) and business disruption (CC9.1), and, if Availability is in scope, backup and recovery infrastructure (A1.2) and recovery plan testing (A1.3).

SOC 2 evidence

Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide. Not sure which frameworks apply to you? Take the compliance scan, or see all solutions.

Evidence at every level

Having the code is the start. Having it back is the goal.

Each rung of evidence shows more of the way there. The base levels hold, check, and certify the deposit. The Pro levels add proof that it builds. The Exit Exercise tests the exit in practice.

Every protection

Vault and plan certificates

The deposit is held, and an automated check confirms what's in it every month, with a Vault Report and a Vault Certificate. Your plan comes with its own certificate too: an Escrow, Resilience, or Continuity Certificate.

Proves: it's there.

Escrow Pro · Resilience Pro · Continuity Pro

Recoverability Certificate

AI agents rebuild a complete deposit on their own in the Codekeeper AI Verification Lab, in hours. Each successful run also gives you the Rebuild Report, an SBOM, and an Exit workbook.

Proves: it builds. Agentic Verification

Add-on to any plan

Exit Exercise Report

Our specialists recover your software from the deposit alone, without the vendor or the original developers, bring the data back, deploy it, and test the business functions you nominate. An annex maps the result to your framework.

Proves: you could exit and keep working. Exit Exercise

The Recoverability Certificate documents the rebuild and its result. It doesn't grant release rights; those come from the agreement. Explore verification

What goes on file

Dated evidence, for every application.

Each protection produces documents tied to one application, so your file shows what was held, what was rebuilt, what was tested, and when.

What your file needs to showCodekeeper evidence
The deposit is held, checked, and currentPlan certificateVault ReportVault CertificateEvery protection. An automated check confirms what's deposited every month, and deposits sync daily through integrations.
The application can be rebuilt without the vendorRecoverability CertificateRebuild ReportEscrow Pro, Resilience Pro, and Continuity Pro. AI agents rebuild a complete deposit on their own in the Codekeeper AI Verification Lab.
You know what's inside it and how to recover itSBOMBuild stepsExit workbookEscrow Pro, Resilience Pro, and Continuity Pro, with every successful rebuild.
Testing is repeated over timeRecoverability Certificates from dated runsUp to four rebuilds a year included, on supported technology stacks, run when you choose: before an audit, after a release, or when the deposit changes.
The exit has been tested in practiceExit Exercise ReportFramework annexExit Exercise, an add-on to any plan. Our specialists recover your software from the deposit alone, without the vendor or the original developers, bring the data back, deploy it, and test the business functions you nominate, with an annex mapped to your framework, such as DORA.
A plan for the live service during an exitLive environment mapContinuity. We map where the application runs at setup, keep the map current, and if the vendor stops we keep the live environment paid and switched on for an agreed period while it's recovered.

Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide. See examples of the documents in the .

Due diligence on Codekeeper

Review us properly, without the chase.

Send your questionnaire, and our compliance team completes it. Confidential documents follow under NDA, through secure channels. General documents are shared without one.

  • ISO/IEC 27001:2022 certified, audited every year by BSI
  • AES-256 encryption at rest, TLS in transit, and every access to deposits logged
  • Agentic Verification runs on Codekeeper's own models, so code never leaves our environment
  • ISO 27001 Certificate, ISMS Summary, Information Security Policy, and Security Assurance Report on request
  • A data processing agreement on request, and personal data handled in line with GDPR
  • Questionnaires completed by our compliance team: tell us the format or portal you need
Open the Trust Center

Your steps, and ours

From questionnaire to a file you can show.

Your review can start as soon as the proposal is shared, alongside the rest of the setup. Due diligence doesn't hold up procurement or account setup.

Your part
What Codekeeper does
1 · Send your request
Send your questionnaire or document request to your Codekeeper contact, with clear requirements and any portal access or format you need.
Completes the questionnaire, and brings in our technical team for specialist questions.
2 · Sign an NDA
Sign the NDA for confidential documents, and confirm the scope of documentation you need.
Shares security policies, ISMS summaries, and audit summaries through secure channels.
3 · Review
Review the documents internally, and flag anything missing or unclear.
Answers follow-up questions and provides additional documentation.
4 · Build your file
Once the protection is live, add each application's certificates and reports to your file.
Issues a dated certificate or report every time a check, a rebuild, or an Exit Exercise runs.

Approving Codekeeper? Read the compliance briefing.

One page for compliance officers: the evidence you'll hold for each application, how it fits your framework, and the documents you'll need to review Codekeeper itself, with the people who'll answer your questions.

Read the briefing

Sample evidence pack

See what your auditor would receive.

An illustrative set of evidence for one application, with example values, so you can judge it before you talk to us.

  • Recoverability Certificate
  • Rebuild Report
  • SBOM and Exit workbook excerpts

Frequently asked questions

Before you sign off.

Will Codekeeper's evidence satisfy our regulator?

Codekeeper gives you evidence for your file: certificates, Rebuild Reports, SBOMs, Exit workbooks and, as an add-on, an Exit Exercise Report. It supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide.

Which documents go in a DORA or PRA SS2/21 file?

The Vault Certificate shows the deposit is held and checked, and your plan certificate shows the arrangement is in place. With the Pro levels, the Recoverability Certificate, Rebuild Report, SBOM, and Exit workbook show it builds and how you would exit. An Exit Exercise Report adds functional testing, with an annex mapped to your framework. See DORA and PRA SS2/21.

Which certifications does Codekeeper hold?

Codekeeper is certified to ISO/IEC 27001:2022, audited by BSI. The data centers our hosting partners run hold ISO 27001 certification and SOC 2 reports. Policies and audit summaries are available through the Trust Center.

Do we need an NDA to see your documents?

Only for confidential security documents. Some documents are public in the Trust Center. For the rest, we ask for a signed NDA first, then share them through secure channels.

Can our review start before sign-up?

Yes. Due diligence can run alongside the other phases, so it doesn't hold up procurement or account setup.

Evidence your assessor can read. Put it on file.

See the certificates and reports on a demo, or get the sample evidence pack and judge the evidence first.

Book a demo